Create dynamic search from lookup

[rdownie]

I would like to be able to take the lookup table defined below and create searches from it.

dsearch.csv

index,source,sourcetype,eventtype
firewall,*,*,*
*,/var/log/syslog,syslog,*
netflow,*,bro,bro_smtp

---

I tried using inputlookup in a subsearch and passing it back, but doesn't work.

search [|inputlookup dsearch.csv | fields index,source,sourcetype,eventtype | format ]
which would return:
((index=firewall AND source=* AND sourcetype=* AND eventtype=*))

I realize I would probably need a map command to do multiple lines, but I can't get it to read work with just one line.
This would be really powerful in validating data is coming in by defined fields for each datasource (i.e, multiple hosts or log files...).
Any help would be appreciated.

Thanks,
Bob

[alacercogitatus · Accepted solution]

You will need to adjust the format command. This allows you to have multiple conditions for the time period you select.

* [ |inputlookup dsearch.csv | fileds index source sourcetype eventtype |  format "(" "(" "" ")" "OR" ")"

And the logic from your example is now:

( ( index="firewall" ) OR ( source="/var/log/syslog" sourcetype="syslog" ) OR ( eventtype="bro_smtp" index="netflow" sourcetype="bro" ) )

[rdownie]

That works for the first line. Now I need to create a new search for each line in the csv. That is a good start.
Thanks,
Bob

[alacercogitatus]

um, no? I took your example as is, so it works for each line in the csv at the SAME time. One search for ALL lines in the CSV. If you want to do something else after the lookup search runs, that is a different question. Please Accept answer as you will.

[rdownie]

I already accepted the answer. You did exactly what I asked. Thanks,

[jeffland]

Not sure if this is what you want, but have you tried | inputlookup | your search?

[rdownie]

I have renamed my fields in the lookup and tried using this format:
|inputlookup index_watch2.csv |map search=search earliest=-5m index=$myindex$ AND host=$myhost$

Which also did not work.

[jeffland]

Oh, I think I just understood what you want. Hm.